Safe MCP server for GitHub Projects v2 — AI-assisted project state, guarded writes, OAuth, ACL, verification, and audit.
Drift inferred · capture-to-capture
No drift recorded — single capability capture; advisories appear once its surface changes.
transport http counts 36 tools · 0 res
· 0 prompts
permission surface via code analysis
tools
-
add_github_project_item
-
analyze_github_project_reconciliation
-
analyze_github_project_state_gaps
-
apply_github_project_bulk_plan
-
approve_github_project_bulk_plan
-
assign_work_item
-
capture_backlog
-
compare_github_project_state_checkpoint
-
create_github_project_state_checkpoint
-
create_work_item
-
get_backlog
-
get_blockers
-
get_github_project
-
get_github_project_brief_context
-
get_github_project_bulk_plan
-
get_github_project_item_relationships
-
get_github_project_snapshot
-
get_identity_context
-
get_my_work
-
get_project_brief
-
get_project_changes
-
get_review_queue
-
get_unassigned_work
-
list_github_project_fields
-
list_github_project_items
-
list_github_project_write_audit_log
-
list_github_projects
-
preview_github_project_bulk_updates
-
resolve_github_issue_or_pr_url
-
resolve_github_project_item
-
start_work
-
update_github_project_item_field
-
update_github_project_item_priority
-
update_github_project_item_status
-
update_work_item_priority
-
update_work_item_status
prompt-surface
shipped agent-instruction files + hidden-content / dangerous-code findings —
quoted from the analyzed source
analyzed commit d742835 · analyzer v33 · 6d ago
danger signals5
- dynamic code execution eval() 4hglee-ops-gyuniverse-github-projects-mcp-d742835/src/core/audit/audit-store.test.ts :25
async eval(_script: string, keys: string[], args: Array<string | number>) { - dynamic code execution eval() 4hglee-ops-gyuniverse-github-projects-mcp-d742835/src/core/audit/audit-store.ts :48
eval(script: string, keys: string[], args: Array<string | number>): Promise<unknown>; - dynamic code execution eval() 4hglee-ops-gyuniverse-github-projects-mcp-d742835/src/core/bulk/bulk-plan-store.test.ts :21
async eval(_script: string, keys: string[], args: Array<string | number>) { - dynamic code execution eval() 4hglee-ops-gyuniverse-github-projects-mcp-d742835/src/core/bulk/bulk-plan-store.ts :39
eval(script: string, keys: string[], args: Array<string | number>): Promise<unknown>; - dynamic code execution eval() 4hglee-ops-gyuniverse-github-projects-mcp-d742835/src/core/relationships/relationship-write-service.test.ts :253
const redis = { async eval(_s: string, _k: string[], args: Array<string | number>) { values.unshift(args[0]); values.splice(Number(args[1])); return 1; },
evidence-backed
findings quoted directly from the published source artifact — not inferred
code files: 128
network 6
- net 4hglee-ops-gyuniverse-github-projects-mcp-d742835/src/github/graphql-client.ts :10
const response = await fetch("https://api.github.com/graphql", { - net (weak) 4hglee-ops-gyuniverse-github-projects-mcp-d742835/src/http/node-server.test.ts :3
import type { AddressInfo } from "node:net"; - net 4hglee-ops-gyuniverse-github-projects-mcp-d742835/src/http/node-server.ts :3
import { createServer, type IncomingMessage, type ServerResponse } from "node:http"; - net 4hglee-ops-gyuniverse-github-projects-mcp-d742835/src/http/remote-mcp.ts :88
return handler.fetch(request); - net (weak) 4hglee-ops-gyuniverse-github-projects-mcp-d742835/src/http/vercel.test.ts :7
const response = await vercelFetchHandler.fetch( - net (weak) 4hglee-ops-gyuniverse-github-projects-mcp-d742835/src/scripts/smoke-http.ts :8
const response = await fetch(`${baseUrl}${path}`);
secrets 3
- secrets 4hglee-ops-gyuniverse-github-projects-mcp-d742835/src/config.ts :29
const githubToken = process.env.GITHUB_TOKEN?.trim(); - secrets (weak) 4hglee-ops-gyuniverse-github-projects-mcp-d742835/src/http/m10-actions.test.ts :112
const previousSecret = process.env.MCP_OAUTH_SIGNING_SECRET; - secrets (weak) 4hglee-ops-gyuniverse-github-projects-mcp-d742835/src/oauth/registration-diagnostic.test.ts :59
const before = process.env.MCP_OAUTH_SIGNING_SECRET;
tool registrations 36
- list_github_projects 4hglee-ops-gyuniverse-github-projects-mcp-d742835/src/mcp/build-server.ts :68
- get_github_project 4hglee-ops-gyuniverse-github-projects-mcp-d742835/src/mcp/build-server.ts :78
- list_github_project_fields 4hglee-ops-gyuniverse-github-projects-mcp-d742835/src/mcp/build-server.ts :88
- list_github_project_items 4hglee-ops-gyuniverse-github-projects-mcp-d742835/src/mcp/build-server.ts :98
- resolve_github_issue_or_pr_url 4hglee-ops-gyuniverse-github-projects-mcp-d742835/src/mcp/build-server.ts :108
- resolve_github_project_item 4hglee-ops-gyuniverse-github-projects-mcp-d742835/src/mcp/build-server.ts :118
- get_github_project_snapshot 4hglee-ops-gyuniverse-github-projects-mcp-d742835/src/mcp/build-server.ts :128
- analyze_github_project_state_gaps 4hglee-ops-gyuniverse-github-projects-mcp-d742835/src/mcp/build-server.ts :138
- analyze_github_project_reconciliation 4hglee-ops-gyuniverse-github-projects-mcp-d742835/src/mcp/build-server.ts :155
- get_github_project_brief_context 4hglee-ops-gyuniverse-github-projects-mcp-d742835/src/mcp/build-server.ts :171
- add_github_project_item 4hglee-ops-gyuniverse-github-projects-mcp-d742835/src/mcp/build-server.ts :181
- update_github_project_item_field 4hglee-ops-gyuniverse-github-projects-mcp-d742835/src/mcp/build-server.ts :196
show 24 more
- preview_github_project_bulk_updates 4hglee-ops-gyuniverse-github-projects-mcp-d742835/src/mcp/bulk-plan-tools.ts :17
- approve_github_project_bulk_plan 4hglee-ops-gyuniverse-github-projects-mcp-d742835/src/mcp/bulk-plan-tools.ts :32
- apply_github_project_bulk_plan 4hglee-ops-gyuniverse-github-projects-mcp-d742835/src/mcp/bulk-plan-tools.ts :42
- get_github_project_bulk_plan 4hglee-ops-gyuniverse-github-projects-mcp-d742835/src/mcp/bulk-plan-tools.ts :52
- create_github_project_state_checkpoint 4hglee-ops-gyuniverse-github-projects-mcp-d742835/src/mcp/checkpoint-tools.ts :17
- compare_github_project_state_checkpoint 4hglee-ops-gyuniverse-github-projects-mcp-d742835/src/mcp/checkpoint-tools.ts :33
- get_identity_context 4hglee-ops-gyuniverse-github-projects-mcp-d742835/src/mcp/high-level-read-tools.ts :55
- get_project_brief 4hglee-ops-gyuniverse-github-projects-mcp-d742835/src/mcp/high-level-read-tools.ts :65
- get_my_work 4hglee-ops-gyuniverse-github-projects-mcp-d742835/src/mcp/high-level-read-tools.ts :77
- get_backlog 4hglee-ops-gyuniverse-github-projects-mcp-d742835/src/mcp/high-level-read-tools.ts :98
- get_review_queue 4hglee-ops-gyuniverse-github-projects-mcp-d742835/src/mcp/high-level-read-tools.ts :110
- get_unassigned_work 4hglee-ops-gyuniverse-github-projects-mcp-d742835/src/mcp/high-level-read-tools.ts :122
- get_blockers 4hglee-ops-gyuniverse-github-projects-mcp-d742835/src/mcp/high-level-read-tools.ts :134
- get_project_changes 4hglee-ops-gyuniverse-github-projects-mcp-d742835/src/mcp/high-level-read-tools.ts :146
- update_work_item_status 4hglee-ops-gyuniverse-github-projects-mcp-d742835/src/mcp/high-level-write-tools.ts :19
- update_work_item_priority 4hglee-ops-gyuniverse-github-projects-mcp-d742835/src/mcp/high-level-write-tools.ts :31
- start_work 4hglee-ops-gyuniverse-github-projects-mcp-d742835/src/mcp/high-level-write-tools.ts :43
- assign_work_item 4hglee-ops-gyuniverse-github-projects-mcp-d742835/src/mcp/high-level-write-tools.ts :55
- capture_backlog 4hglee-ops-gyuniverse-github-projects-mcp-d742835/src/mcp/high-level-write-tools.ts :67
- create_work_item 4hglee-ops-gyuniverse-github-projects-mcp-d742835/src/mcp/high-level-write-tools.ts :83
- get_github_project_item_relationships 4hglee-ops-gyuniverse-github-projects-mcp-d742835/src/mcp/relationship-tools.ts :5
- update_github_project_item_status 4hglee-ops-gyuniverse-github-projects-mcp-d742835/src/mcp/workflow-write-tools.ts :46
- update_github_project_item_priority 4hglee-ops-gyuniverse-github-projects-mcp-d742835/src/mcp/workflow-write-tools.ts :58
- list_github_project_write_audit_log 4hglee-ops-gyuniverse-github-projects-mcp-d742835/src/mcp/workflow-write-tools.ts :70
declared dependencies 8
- @modelcontextprotocol/node@^2.0.0
- @modelcontextprotocol/server@^2.0.0
- @upstash/redis@^1.38.4
- dotenv@^17.4.2
- zod@^4.5.4
- @types/node@^26.4.1
- tsx@^4.23.13
- typescript@^7.0.2